I was wondering if anyone has by any chance got any advice on how to stop people from multiplay when they are spoofing ip's. Kinda screws up the ban code. I understand that there is something inheriently difficult in detecting this, but maybe someone knows a way to get around it.
IP spoofing
Posted by Greven on Fri 05 Nov 2004 04:35 AM — 6 posts, 29,766 views.
How do you know they are spoofing ips? Could it be that they are just proxying through something like SOCKS or connecting through a remote shell?
If they are connecting through a remote shell, then there is not much that you can really do besides for watching for collusion or maybe checking if the ip comes from a known shell host.
If they are proxying through SOCKS, you can always check to see if the connecting system is running SOCKS, since it commonly uses certain ports like 1080. However, if a SOCKS port can not be found or they are using some weird proxy protocol, then checking for collusion is probably the best method.
If they are connecting through a remote shell, then there is not much that you can really do besides for watching for collusion or maybe checking if the ip comes from a known shell host.
If they are proxying through SOCKS, you can always check to see if the connecting system is running SOCKS, since it commonly uses certain ports like 1080. However, if a SOCKS port can not be found or they are using some weird proxy protocol, then checking for collusion is probably the best method.
The person told us that he was spoofing. As for checking for collusion, is there somewhere that may have some information on this? I am severly inexperienced in network connections.
As I understand it, spoofing is changing the 13-20th bytes of an IP packet. I don't know if that can be detected within the confines of a mud code, but...
I don't know if this can be done, as I understand that this would cause problems with sending the information to the wrong place, though the host is only checked once and then allocated into a string, as I understand it.
As I understand it, spoofing is changing the 13-20th bytes of an IP packet. I don't know if that can be detected within the confines of a mud code, but...
I don't know if this can be done, as I understand that this would cause problems with sending the information to the wrong place, though the host is only checked once and then allocated into a string, as I understand it.
I don't quite see how someone can "spoof" an IP address in this context. Normally hosts respond by returning to the IP address in the packet header. If you spoof it (which you can if you try) the response goes to someone else.
The thing that is checked once is domain-name resolution, where an address like 1.2.3.4 gets translated into a name (like myhost.org).
Read http://www.grc.com/dos/drdos.htm, it is a rattling good yarn about attacks and spoofs.
I think on that page, or a nearby one (http://www.grc.com/dos/grcdos.htm), the fellow who wrote it, who runs a company that specialises in Internet security, admitted that if someone really wanted to "get him" they could (by using thousands of "zombie" PCs that they control through trojan horses and viruses) and that he couldn't stop them. Basically in the end he managed to find the person responsible and had to ask him nicely to stop. Read it and you'll see why.
I recommend you read both those pages, they are well laid out and fascinating.
I don't think you can do much about it. Even detecting people with the *same* IP address can fail with false positives. Say 100 people are behind a NAT router, they will all have the same IP address, but could actually be 100 different players, all sitting at different PCs.
Wow. After reading those two pages now I'm kinda scared about the internet. :o
Good reading Nick, thanks for the links. Anavel is right, this sorta thing does give you the creeps. :P